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IN THE SPECIFICATION 

Please amend paragraph [0028] as follows: 

[0028] The f l own flow assembled by the roassombor reassembler 36 can then be 

provided to a protocol demultiplexer (demux) 38. In one embodiment, the protocol demux 38 
sorts assembled flows using the TCP Ports. This can include performing a speculative 
classification of the flow contents based on the association of well-known port numbers with 
specified protocols. For example, Web Hyper Text Transfer Protocol (HTTP) packets— i.e., Web 
traffic— are typically associated with port 80, File Transfer Protocol (FTP) packets with port 20, 
Kerberos authentication packets with port 88, and so on. Thus in one embodiment, the 
protocol demux 38 separates all the different protocols in one flow. 

Please replace paragraph [0030] with the following paragraph: 

[0030] In one embodiment, the object assembly module 28 outputs each flow organized by 
protocol, which represents the underlying objects. Referring again to Figure 3, these objects 
can then be handed over to the object classification module 30 (sometimes also referred to as 
the "content classifier") for classification based on content. A classified flow may still contain 
multiple content objects depending on the protocol used. For example, protocols such as 
HTTP (Internet Web Surfing) may contain over 100 objects of any number of content types in 
a single flow. To deconstruct the flow, each object contained in the flow is individually 
extracted, and decoded, if necessary, by the object classification module 30.- 


